PT-2020-18767 · Nginx · Nginx Controller

Published 2020-04-23 · Updated 2020-04-30 · CVE-2020-5866

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions NGINX Controller versions prior to 3.3.0

Description The helper.sh script in NGINX Controller uses sensitive items as command-line arguments, which poses a security risk. This issue is present in versions of NGINX Controller prior to 3.3.0.

Recommendations For versions prior to 3.3.0, update to version 3.3.0 or later to resolve the issue. As a temporary workaround, consider restricting the use of the helper.sh script until a patch is available.

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

CVE-2020-5866

Affected Products

Nginx Controller

References · 5

• https://support.f5.com/csp/article/K11922628 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-5866 · Security Note
• https://osv.dev/vulnerability/CVE-2020-5866 · Vendor Advisory
• https://security.netapp.com/advisory/ntap-20200430-0005 · Note
• https://t.me/cvenotify/3139 · Telegram Post